PhantomPulse Payload Check URI

nomit vyas@xoxo

•updated Apr 20, 2026•0•162

This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for the URL pattern '/v1/updates/check?build=payloads' within process command lines on Windows systems, indicating communication with the PhantomPulse C2 infrastructure.